PII Scrubbing

PII scrubbing is the step that removes or replaces identifying data before an event or a recording is stored, so the raw value never reaches the store at all.

Scrubbing takes three common forms: dropping the field entirely, replacing the value with a fixed token, and masking the content of input fields before the data leaves the browser. The right place for it is at capture time or as a mandatory pipeline stage before storage; hiding a column only at query time is not scrubbing, because the raw value is still sitting in the store. The leakiest point is usually the page URL itself, since parameters such as an email or phone number in a query string are captured automatically on every pageview, so scrubbing event properties without an allow-list for URL parameters leaves the hole open. Scrubbing also differs from pseudonymization: scrubbing destroys the value, while pseudonymization swaps it for a key that keeps re-linking possible.